View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 221

Which protocol is commonly used to securely transfer files between network devices using SSH encryption?

1. SCP
2. FTP
3. TFTP
4. HTTP

Correct Answer: 1

Explanation

Secure Copy Protocol, or SCP, transfers files between systems using the SSH protocol. Because SSH provides encryption, SCP helps protect both authentication information and file contents while they are being transferred. Network administrators can use SCP to move configuration files, software images, logs, and other sensitive files between devices. FTP does not provide encryption by default, TFTP provides only basic file-transfer functionality, and HTTP is primarily a web communication protocol. SCP is therefore an appropriate choice when files need to be transferred securely between network devices or systems.

Question 222

Which authentication protocol is commonly used by network devices to communicate with a centralized AAA server and encrypt the password during transmission?

1. FTP
2. Telnet
3. RADIUS
4. HTTP

Correct Answer: 3

Explanation

RADIUS is a widely used AAA protocol that provides centralized authentication, authorization, and accounting services. It is commonly used for network access authentication, including wireless networks and 802.1X deployments. RADIUS encrypts the user’s password during transmission between the network access device and the RADIUS server, while other packet information is not encrypted in the same manner. FTP is a file-transfer protocol, Telnet provides unencrypted remote access, and HTTP is a web protocol. Therefore, RADIUS is the correct protocol for centralized AAA authentication in this scenario.

Question 223

Which security control can detect and block unauthorized network traffic based on predefined security rules?

1. DNS server
2. Firewall
3. NTP server
4. DHCP server

Correct Answer: 4

Explanation

A firewall monitors network traffic and applies configured security policies to determine whether connections should be allowed or denied. Modern firewalls can inspect traffic based on addresses, ports, protocols, connection state, applications, and other characteristics. Depending on the firewall type, it can also detect suspicious or malicious activity and block it. DNS servers resolve domain names, NTP servers synchronize system clocks, and DHCP servers assign network configuration information. Therefore, a firewall is the security control designed to enforce rules that allow or block network traffic.

Question 224

Which security technology provides centralized authentication and authorization for administrators accessing network devices?

1. NAT
2. DNSSEC
3. DHCP snooping
4. AAA

Correct Answer: 4

Explanation

AAA stands for Authentication, Authorization, and Accounting. It provides a framework for controlling administrative access to network devices. Authentication verifies the administrator’s identity, authorization determines what actions the administrator is permitted to perform, and accounting records activity for auditing purposes. Technologies such as TACACS+ and RADIUS can provide AAA services. NAT translates addresses, DNSSEC protects DNS information, and DHCP snooping helps protect against unauthorized DHCP servers. Therefore, AAA is the correct security framework for centralized administrator access control.

Question 225

Which security feature can restrict a switch port to a specific number of learned MAC addresses?

1. Port security
2. DNSSEC
3. IPsec
4. Syslog

Correct Answer: 1

Explanation

Switch port security allows administrators to limit the number of MAC addresses that can appear on a switch port. It can use statically configured addresses or dynamically learned addresses and can specify what action should occur when a violation is detected. This helps prevent unauthorized devices from connecting to protected switch ports and can reduce the impact of certain MAC-based attacks. DNSSEC protects DNS data, IPsec provides secure IP communications, and Syslog collects event messages. Therefore, port security is the appropriate feature for restricting the number of MAC addresses on a switch port.

Question 226

Which attack attempts to overwhelm a switch’s CAM table with many fake MAC addresses?

1. DHCP starvation
2. MAC flooding
3. DNS poisoning
4. Phishing

Correct Answer: 2

Explanation

A MAC flooding attack attempts to fill a switch’s Content Addressable Memory, or CAM, table with a large number of fabricated MAC addresses. When the table becomes full, the switch may have difficulty determining the correct destination port for new frames and may flood traffic out multiple ports, depending on its behavior. This can provide an attacker with opportunities to observe traffic that should normally be restricted to specific ports. Port security and other switch-security mechanisms can help reduce this risk. Therefore, MAC flooding is the correct attack type.

Question 227

Which technology can authenticate a device before allowing it to gain normal access to a wired network port?

1. 802.1X
2. NAT
3. FTP
4. DNS

Correct Answer: 1

Explanation

IEEE 802.1X provides port-based network access control and can require authentication before normal network access is granted. It is commonly deployed with a supplicant on the endpoint, an authenticator such as a switch, and an authentication server such as RADIUS. This allows organizations to enforce identity-based access policies on wired or wireless networks. NAT translates addresses, FTP transfers files, and DNS resolves domain names. Therefore, 802.1X is the technology used to authenticate devices before granting normal access to a protected network port.

Question 228

Which device in an 802.1X architecture typically acts as the intermediary between the endpoint and the authentication server?

1. Supplicant
2. Certificate Authority
3. Authenticator
4. SIEM

Correct Answer: 3

Explanation

The authenticator in an 802.1X deployment is typically a network switch or wireless access point. It controls access to the network connection and exchanges authentication information between the endpoint and the authentication server. The endpoint is called the supplicant, while the authentication server commonly uses RADIUS to validate credentials. A Certificate Authority issues and manages digital certificates, and a SIEM collects and analyzes security events. Therefore, the authenticator is the intermediary that controls the network access point and communicates with the authentication infrastructure.

Question 229

Which attack involves sending forged ARP messages to associate an attacker’s MAC address with another device’s IP address?

1. DNS tunneling
2. ARP spoofing
3. DHCP starvation
4. VLAN hopping

Correct Answer: 2

Explanation

ARP spoofing occurs when an attacker sends forged Address Resolution Protocol messages to manipulate IP-to-MAC address mappings on a local network. By associating the attacker’s MAC address with another host’s IP address, the attacker may intercept or redirect traffic. This technique can be used as part of a man-in-the-middle attack. Dynamic ARP Inspection, often combined with DHCP snooping, can help validate ARP messages and reduce this risk. DNS tunneling involves DNS traffic, DHCP starvation consumes address pools, and VLAN hopping targets VLAN boundaries. Therefore, ARP spoofing is correct.

Question 230

Which switch security feature can validate ARP packets using trusted IP-to-MAC bindings?

1. Port mirroring
2. DHCP relay
3. IP Source Guard
4. Dynamic ARP Inspection

Correct Answer: 4

Explanation

Dynamic ARP Inspection, or DAI, validates ARP messages against trusted IP-to-MAC address bindings. These bindings are commonly obtained through DHCP snooping. If an ARP message does not match the expected binding, the switch can drop the packet. This helps protect against ARP spoofing and ARP poisoning attacks that could otherwise allow an attacker to intercept local network traffic. Port mirroring copies traffic for analysis, DHCP relay forwards DHCP messages between networks, and IP Source Guard validates source addresses rather than directly inspecting ARP messages. Therefore, DAI is correct.

Question 231

Which security mechanism helps ensure that a host can only use an IP address associated with its legitimate MAC address?

1. IP Source Guard
2. DNSSEC
3. WPA3
4. Syslog

Correct Answer: 1

Explanation

IP Source Guard is a switch security feature that helps prevent IP address spoofing on access ports. It can use trusted bindings, commonly learned through DHCP snooping, to verify that traffic from a device uses an authorized IP address. If the source information does not match the expected binding, the switch can block the traffic. DNSSEC protects DNS integrity, WPA3 provides wireless security, and Syslog collects event information. IP Source Guard is therefore the appropriate technology for helping ensure that hosts use legitimate IP addresses associated with their expected network identity.

Question 232

Which wireless security mode commonly uses a pre-shared key for authentication?

1. WPA2-Enterprise
2. WPA2-Personal
3. 802.1X Enterprise only
4. Open authentication

Correct Answer: 2

Explanation

WPA2-Personal commonly uses a pre-shared key, or PSK, for wireless authentication. Users connect to the wireless network using a shared passphrase configured on the access point and client devices. This is different from WPA2-Enterprise, which generally uses 802.1X and a centralized authentication server such as RADIUS. Open authentication does not provide equivalent wireless access protection. WPA2-Personal can provide strong security when a sufficiently complex passphrase is used and the configuration is properly maintained. Therefore, WPA2-Personal is the correct answer.

Question 233

Which wireless security mode commonly uses 802.1X and a centralized authentication server?

1. WPA2-Personal
2. Open authentication
3. WPA2-Enterprise
4. WEP shared key

Correct Answer: 3

Explanation

WPA2-Enterprise commonly uses IEEE 802.1X for network access authentication and a centralized authentication server such as RADIUS. Instead of relying on one shared wireless password for every user, individual users or devices can authenticate using credentials or certificates. This provides stronger centralized control and makes it easier to revoke access for a specific user without changing a shared network password for everyone. WPA2-Personal uses a pre-shared key, while open authentication does not provide comparable authentication protection. Therefore, WPA2-Enterprise is the correct wireless security mode.

Question 234

Which VPN technology commonly uses encryption and authentication at the IP layer to protect network traffic?

1. FTP
2. SSH
3. IPsec
4. SNMP

Correct Answer: 3

Explanation

IPsec is a suite of protocols and technologies designed to protect IP communications. It can provide confidentiality, integrity, authentication, and anti-replay protection depending on the configuration. IPsec is commonly used for site-to-site VPNs and remote-access VPN solutions. FTP is a file-transfer protocol, SSH provides secure remote administration and other encrypted communication, and SNMP is used for network management. IPsec operates at the IP layer and is well suited for protecting communication between networks or endpoints. Therefore, IPsec is the correct VPN technology.

Question 235

Which VPN type is commonly used to securely connect two separate corporate networks over the Internet?

1. Site-to-site VPN
2. Remote desktop
3. Local-area VPN
4. Application proxy

Correct Answer: 1

Explanation

A site-to-site VPN creates a secure connection between two separate networks, such as two corporate offices, over an untrusted network such as the Internet. VPN gateways at each location establish the protected tunnel and encrypt traffic passing between the networks. Users at each site can often access permitted resources without individually establishing a VPN session. Remote-access VPNs are instead designed primarily for individual users connecting to an organization’s network. Application proxies provide application-level intermediary services. Therefore, a site-to-site VPN is the correct solution for connecting two corporate networks securely.

Question 236

Which security technology provides encrypted remote access for users who need to connect to an organization’s internal network from an external location?

1. DHCP snooping
2. Remote-access VPN
3. Port security
4. DNSSEC

Correct Answer: 2

Explanation

A remote-access VPN allows individual users to establish an encrypted connection to an organization’s network from an external location. Once authenticated and authorized, the user can access permitted internal resources through the VPN according to organizational policies. Remote-access VPNs may use technologies such as IPsec or TLS-based mechanisms depending on the solution. DHCP snooping protects against certain DHCP attacks, port security restricts switch ports, and DNSSEC protects DNS integrity. Therefore, a remote-access VPN is the appropriate technology for secure remote connectivity to internal resources.

Question 237

Which security technology can inspect traffic and automatically block known malicious patterns before they reach protected systems?

1. IDS
2. SIEM
3. IPS
4. Syslog

Correct Answer: 3

Explanation

An Intrusion Prevention System, or IPS, monitors network traffic and can actively block or prevent detected malicious activity. IPS technologies may use signatures, reputation information, protocol analysis, behavioral techniques, and other detection mechanisms to identify threats. An IDS can detect and alert on suspicious activity but traditionally does not directly block traffic. SIEM platforms collect and correlate security events, while Syslog provides a mechanism for transporting event messages. Therefore, IPS is the technology that can inspect traffic and automatically take preventive action against detected threats.

Question 238

Which system is primarily designed to collect, correlate, and analyze security logs from multiple devices?

1. SIEM
2. DHCP
3. NAT
4. DNS

Correct Answer: 1

Explanation

A Security Information and Event Management, or SIEM, system centralizes security-related events from many sources. It can collect logs from firewalls, servers, endpoints, applications, authentication systems, and network devices and correlate them to identify suspicious patterns. SIEM platforms can generate alerts, support investigations, and provide dashboards for security monitoring. DHCP assigns IP configuration, NAT translates addresses, and DNS resolves domain names. A SIEM can therefore provide centralized visibility across an organization’s security environment and help analysts investigate events that might not be obvious from a single device’s logs.

Question 239

Which security control can identify unauthorized changes to important files by comparing their current state with a known trusted state?

1. Firewall
2. File integrity monitoring
3. DHCP snooping
4. Network Address Translation

Correct Answer: 2

Explanation

File Integrity Monitoring, or FIM, detects changes to important files and system objects by comparing their current state with a known baseline or trusted state. Depending on the implementation, FIM can monitor file hashes, permissions, ownership, timestamps, and other attributes. Unexpected modifications may indicate malware activity, unauthorized administrative changes, or configuration tampering. Firewalls control network traffic, DHCP snooping protects against certain DHCP attacks, and NAT translates IP addresses. Therefore, file integrity monitoring is the security control designed to detect unauthorized changes to protected files.

Question 240

Which security practice involves securely removing sensitive information so that it cannot be recovered from discarded storage media?

1. Data classification
2. Data masking
3. Data retention
4. Secure data destruction

Correct Answer: 4

Explanation

Secure data destruction involves permanently removing sensitive information from storage media so that unauthorized parties cannot recover it. Depending on the media and organizational requirements, methods may include cryptographic erasure, secure wiping, degaussing for appropriate magnetic media, or physical destruction. Data classification identifies the sensitivity of information, data masking hides sensitive values while retaining usable data, and data retention defines how long information should be stored. Secure destruction is particularly important when computers, storage devices, or other media are retired or disposed of. Therefore, secure data destruction is correct.